@opensoha/contracts 0.1.27 → 0.2.0

package/resource/runtime/pod_terminal_test.go

@@ -0,0 +1,170 @@
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	contractresource "github.com/opensoha/soha/contracts/resource"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+	"k8s.io/client-go/tools/remotecommand"
+	utilexec "k8s.io/client-go/util/exec"
+)
+
+type terminalSizes struct{}
+
+func (terminalSizes) Next(context.Context) *contractresource.NativeTerminalSize {
+	return &contractresource.NativeTerminalSize{Width: 120, Height: 40}
+}
+
+func TestNativeTerminalUsesPTYMergedOutputAndExactShell(t *testing.T) {
+	client := fake.NewClientset(executionFixturePod())
+	stdin := []byte{0, 255, '\n'}
+	var output bytes.Buffer
+	factory := func(_, _ string, options corev1.PodExecOptions) (remotecommand.Executor, error) {
+		if !options.TTY || !options.Stdin || !options.Stdout || options.Stderr || options.Container != "main" || !reflect.DeepEqual(options.Command, []string{"/bin/bash"}) {
+			t.Fatalf("unsafe PTY options: %+v", options)
+		}
+		return podExecutorStub{run: func(_ context.Context, streams remotecommand.StreamOptions) error {
+			if streams.Stderr != nil || !streams.Tty {
+				t.Fatal("PTY must negotiate TTY and merged output in the stream transport")
+			}
+			size := streams.TerminalSizeQueue.Next()
+			if size == nil || size.Width != 120 || size.Height != 40 {
+				t.Fatal("resize lost")
+			}
+			data, _ := io.ReadAll(streams.Stdin)
+			if !bytes.Equal(data, stdin) {
+				t.Fatal("binary stdin changed")
+			}
+			_, err := streams.Stdout.Write([]byte{255, 0, 27})
+			return err
+		}}, nil
+	}
+	result, err := StreamPodTerminal(t.Context(), client, nil, "test", "fixture", contractresource.PodTerminalInput{ExpectedUID: "reviewed", Shell: "bash"}, io.NopCloser(bytes.NewReader(stdin)), &output, terminalSizes{}, factory)
+	if err != nil || result.Status != "succeeded" || result.InputBytes != 3 || result.OutputBytes != 3 || !bytes.Equal(output.Bytes(), []byte{255, 0, 27}) {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+	if err = result.Validate(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestNativeTerminalExitCancelTimeoutAndChangedTarget(t *testing.T) {
+	for _, scenario := range []string{"exit", "transport", "changed", "canceled", "deadline", "invalid-exit"} {
+		t.Run(scenario, func(t *testing.T) {
+			client := fake.NewClientset(executionFixturePod())
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			factory := func(_, _ string, _ corev1.PodExecOptions) (remotecommand.Executor, error) {
+				return podExecutorStub{run: func(runCtx context.Context, _ remotecommand.StreamOptions) error {
+					switch scenario {
+					case "exit":
+						return utilexec.CodeExitError{Err: errors.New("PRIVATE"), Code: 42}
+					case "transport":
+						return errors.New("PRIVATE")
+					case "invalid-exit":
+						return utilexec.CodeExitError{Err: errors.New("PRIVATE"), Code: 0}
+					case "changed":
+						pod, _ := client.CoreV1().Pods("test").Get(ctx, "fixture", metav1.GetOptions{})
+						pod.UID = "replacement"
+						_, err := client.CoreV1().Pods("test").Update(ctx, pod, metav1.UpdateOptions{})
+						return err
+					case "canceled":
+						cancel()
+						return nil
+					case "deadline":
+						<-runCtx.Done()
+						return nil
+					}
+					return nil
+				}}, nil
+			}
+			input := contractresource.PodTerminalInput{ExpectedUID: "reviewed", TimeoutSeconds: 1}
+			result, err := StreamPodTerminal(ctx, client, nil, "test", "fixture", input, io.NopCloser(strings.NewReader("")), io.Discard, terminalSizes{}, factory)
+			if err != nil {
+				t.Fatal(err)
+			}
+			want := map[string]string{"exit": "failed", "transport": "transport_lost", "changed": "unknown", "canceled": "canceled", "deadline": "timed_out", "invalid-exit": "transport_lost"}[scenario]
+			if result.Status != want {
+				t.Fatalf("result=%+v want=%s", result, want)
+			}
+			if err = result.Validate(); err != nil {
+				t.Fatal(err)
+			}
+			if scenario == "canceled" && len(client.Actions()) != 1 {
+				t.Fatal("read Kubernetes after cancellation")
+			}
+		})
+	}
+}
+
+func TestNativeTerminalRejectsUIDBeforeOpeningAndRetainsForbidden(t *testing.T) {
+	client := fake.NewClientset(executionFixturePod())
+	called := false
+	factory := func(_, _ string, _ corev1.PodExecOptions) (remotecommand.Executor, error) {
+		called = true
+		return nil, errors.New("must not call")
+	}
+	_, err := StreamPodTerminal(t.Context(), client, nil, "test", "fixture", contractresource.PodTerminalInput{ExpectedUID: "changed"}, io.NopCloser(strings.NewReader("")), io.Discard, terminalSizes{}, factory)
+	if !apierrors.IsConflict(err) || called {
+		t.Fatalf("err=%v called=%v", err, called)
+	}
+	factory = func(_, _ string, _ corev1.PodExecOptions) (remotecommand.Executor, error) {
+		return podExecutorStub{run: func(context.Context, remotecommand.StreamOptions) error { return apierrors.NewUnauthorized("PRIVATE") }}, nil
+	}
+	_, err = StreamPodTerminal(t.Context(), client, nil, "test", "fixture", contractresource.PodTerminalInput{ExpectedUID: "reviewed"}, io.NopCloser(strings.NewReader("")), io.Discard, terminalSizes{}, factory)
+	if !apierrors.IsUnauthorized(err) {
+		t.Fatalf("lost API denial: %v", err)
+	}
+}
+
+func TestNativeTerminalBoundsProviderIOAndUnblocksStdinOnDeadline(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	reader := &terminalInputReader{reader: bytes.NewReader(make([]byte, contractresource.NativePodTerminalMaxInputBytes+1)), cancel: cancel}
+	if n, err := io.Copy(io.Discard, reader); n != contractresource.NativePodTerminalMaxInputBytes || !errors.Is(err, errTerminalInputLimit) {
+		t.Fatalf("input n=%d err=%v", n, err)
+	}
+	if ctx.Err() == nil {
+		t.Fatal("input limit did not cancel")
+	}
+	ctx, cancel = context.WithCancel(t.Context())
+	defer cancel()
+	writer := &terminalOutputWriter{writer: io.Discard, cancel: cancel}
+	writer.count.Store(contractresource.NativePodTerminalMaxOutputBytes - 2)
+	if n, err := writer.Write([]byte("abcd")); n != 2 || !errors.Is(err, errTerminalOutputLimit) {
+		t.Fatalf("output n=%d err=%v", n, err)
+	}
+	if ctx.Err() == nil {
+		t.Fatal("output limit did not cancel")
+	}
+	client := fake.NewClientset(executionFixturePod())
+	pipe, peer := io.Pipe()
+	defer func() { _ = peer.Close() }()
+	finished := make(chan error, 1)
+	factory := func(_, _ string, _ corev1.PodExecOptions) (remotecommand.Executor, error) {
+		return podExecutorStub{run: func(_ context.Context, streams remotecommand.StreamOptions) error {
+			_, err := io.Copy(io.Discard, streams.Stdin)
+			finished <- err
+			return err
+		}}, nil
+	}
+	result, err := StreamPodTerminal(t.Context(), client, nil, "test", "fixture", contractresource.PodTerminalInput{ExpectedUID: "reviewed", TimeoutSeconds: 1}, pipe, io.Discard, terminalSizes{}, factory)
+	if err != nil || result.Status != "timed_out" {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+	select {
+	case <-finished:
+	case <-time.After(time.Second):
+		t.Fatal("stdin remained blocked")
+	}
+}

package/resource/runtime/presence.go

@@ -0,0 +1,58 @@
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	contractresource "github.com/opensoha/soha/contracts/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+)
+
+type ResourceMetadataLister interface {
+	List(context.Context, metav1.ListOptions) (*metav1.PartialObjectMetadataList, error)
+}
+
+// ObserveResourcePresence uses a successful complete metadata-only collection,
+// never GET/404, as the object-presence oracle. A missing API, RBAC denial, stale
+// transport or unsupported partial metadata produces an error, not absence.
+func ObserveResourcePresence(ctx context.Context, client ResourceMetadataLister, kind, namespace, name string) (contractresource.ResourcePresence, error) {
+	definition, ok := contractresource.LookupKubernetesResourceKind(kind)
+	if !ok || !definition.GenericYAML || client == nil {
+		return contractresource.ResourcePresence{}, fmt.Errorf("unsupported resource presence target")
+	}
+	apiVersion := definition.Version
+	if definition.Group != "" {
+		apiVersion = definition.Group + "/" + definition.Version
+	}
+	result := contractresource.ResourcePresence{Protocol: contractresource.ResourcePresenceProtocol, APIVersion: apiVersion,
+		Resource: definition.Resource, Kind: kind, Namespace: namespace, Name: name, CollectionResourceVersion: "pending", State: "absent"}
+	if err := result.ValidateFor(kind, namespace, name); err != nil {
+		return contractresource.ResourcePresence{}, err
+	}
+	query, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	// Empty resourceVersion requests the current collection; "0" would permit
+	// an older cached snapshot. Never follow pagination or expand the selector.
+	items, err := client.List(query, metav1.ListOptions{FieldSelector: fields.OneTermEqualSelector("metadata.name", name).String(), Limit: 2})
+	if err != nil {
+		return contractresource.ResourcePresence{}, err
+	}
+	if items == nil || items.ResourceVersion == "" || items.Continue != "" || len(items.Items) > 1 || items.RemainingItemCount != nil && *items.RemainingItemCount != 0 {
+		return contractresource.ResourcePresence{}, fmt.Errorf("resource presence collection is incomplete")
+	}
+	result.CollectionResourceVersion = items.ResourceVersion
+	if len(items.Items) == 1 {
+		item := items.Items[0]
+		if item.Name != name || item.Namespace != namespace {
+			return contractresource.ResourcePresence{}, fmt.Errorf("resource presence collection target changed")
+		}
+		result.State, result.UID, result.ResourceVersion = "present", string(item.UID), item.ResourceVersion
+		if item.DeletionTimestamp != nil {
+			stamp := item.DeletionTimestamp.Time
+			result.DeletionTimestamp = &stamp
+		}
+	}
+	return result, result.ValidateFor(kind, namespace, name)
+}

package/resource/runtime/presence_metadata.go

@@ -0,0 +1,85 @@
+package runtime
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"k8s.io/client-go/metadata"
+	"k8s.io/client-go/rest"
+)
+
+// NewPresenceMetadataClient removes client-go's full-object JSON fallback for
+// this protocol only. Other callers retain their existing metadata clients.
+func NewPresenceMetadataClient(config *rest.Config) (metadata.Interface, error) {
+	if config == nil {
+		return nil, fmt.Errorf("resource presence metadata transport is unavailable")
+	}
+	copy := rest.CopyConfig(config)
+	copy.Wrap(func(base http.RoundTripper) http.RoundTripper { return presenceMetadataTransport{base: base} })
+	return metadata.NewForConfig(copy)
+}
+
+type presenceMetadataTransport struct{ base http.RoundTripper }
+
+func (t presenceMetadataTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	copy := request.Clone(request.Context())
+	copy.Header = request.Header.Clone()
+	copy.Header.Set("Accept", "application/json;as=PartialObjectMetadataList;g=meta.k8s.io;v=v1")
+	response, err := t.base.RoundTrip(copy)
+	if err != nil {
+		return nil, err
+	}
+	const maximum = 2 << 20
+	raw, readErr := io.ReadAll(io.LimitReader(response.Body, maximum+1))
+	closeErr := response.Body.Close()
+	if readErr != nil || closeErr != nil || len(raw) > maximum {
+		return nil, fmt.Errorf("bounded resource presence response is unavailable")
+	}
+	if response.StatusCode >= 200 && response.StatusCode < 300 && !presenceMetadataResponse(raw) {
+		return nil, fmt.Errorf("resource presence requires a metadata-only collection")
+	}
+	response.Body = io.NopCloser(bytes.NewReader(raw))
+	return response, nil
+}
+
+func presenceMetadataResponse(raw []byte) bool {
+	var top map[string]json.RawMessage
+	if json.Unmarshal(raw, &top) != nil || top == nil {
+		return false
+	}
+	for key := range top {
+		if key != "apiVersion" && key != "kind" && key != "metadata" && key != "items" {
+			return false
+		}
+	}
+	var value struct {
+		APIVersion string            `json:"apiVersion"`
+		Kind       string            `json:"kind"`
+		Items      []json.RawMessage `json:"items"`
+	}
+	if json.Unmarshal(raw, &value) != nil || value.Kind != "PartialObjectMetadataList" || value.APIVersion != "meta.k8s.io/v1" || !presenceListItemsExplicit(top, value.Items) {
+		return false
+	}
+	for _, rawItem := range value.Items {
+		var item map[string]json.RawMessage
+		if json.Unmarshal(rawItem, &item) != nil || item == nil {
+			return false
+		}
+		for key := range item {
+			if key != "apiVersion" && key != "kind" && key != "metadata" {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func presenceListItemsExplicit(top map[string]json.RawMessage, items []json.RawMessage) bool {
+	raw, exists := top["items"]
+	// Kubernetes PartialObjectMetadataList encodes an empty collection as null.
+	// A missing items member is not an explicit empty collection.
+	return exists && (items != nil || bytes.Equal(bytes.TrimSpace(raw), []byte("null")))
+}

package/resource/runtime/presence_metadata_test.go

@@ -0,0 +1,56 @@
+package runtime
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/rest"
+)
+
+func TestPresenceUsesOnlyBoundedPartialMetadataTransport(t *testing.T) {
+	for _, scenario := range []string{"partial", "partial-null", "missing-items", "full-object", "unsupported", "oversized", "top-extra", "item-extra"} {
+		t.Run(scenario, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != "GET" || r.URL.Path != "/api/v1/namespaces/team-a/configmaps" || r.URL.Query().Get("fieldSelector") != "metadata.name=app" || r.URL.Query().Get("limit") != "2" || r.Header.Get("Accept") != "application/json;as=PartialObjectMetadataList;g=meta.k8s.io;v=v1" {
+					t.Error("metadata-only target or negotiation changed")
+					w.WriteHeader(400)
+					return
+				}
+				w.Header().Set("Content-Type", "application/json")
+				switch scenario {
+				case "unsupported":
+					w.WriteHeader(404)
+				case "oversized":
+					_, _ = io.WriteString(w, strings.Repeat(" ", (2<<20)+1))
+				case "full-object":
+					_, _ = io.WriteString(w, `{"apiVersion":"v1","kind":"ConfigMapList","metadata":{"resourceVersion":"opaque"},"items":[]}`)
+				case "partial-null":
+					_, _ = io.WriteString(w, `{"apiVersion":"meta.k8s.io/v1","kind":"PartialObjectMetadataList","metadata":{"resourceVersion":"opaque"},"items":null}`)
+				case "missing-items":
+					_, _ = io.WriteString(w, `{"apiVersion":"meta.k8s.io/v1","kind":"PartialObjectMetadataList","metadata":{"resourceVersion":"opaque"}}`)
+				case "top-extra":
+					_, _ = io.WriteString(w, `{"apiVersion":"meta.k8s.io/v1","kind":"PartialObjectMetadataList","metadata":{"resourceVersion":"opaque"},"items":[],"spec":{"private":"must-not-cross"}}`)
+				case "item-extra":
+					_, _ = io.WriteString(w, `{"apiVersion":"meta.k8s.io/v1","kind":"PartialObjectMetadataList","metadata":{"resourceVersion":"opaque"},"items":[{"metadata":{"name":"app","namespace":"team-a","uid":"uid","resourceVersion":"v"},"data":{"private":"must-not-cross"}}]}`)
+				default:
+					_, _ = io.WriteString(w, `{"apiVersion":"meta.k8s.io/v1","kind":"PartialObjectMetadataList","metadata":{"resourceVersion":"opaque"},"items":[]}`)
+				}
+			}))
+			defer server.Close()
+			client, err := NewPresenceMetadataClient(&rest.Config{Host: server.URL})
+			if err != nil {
+				t.Fatal(err)
+			}
+			resource := client.Resource(schema.GroupVersionResource{Version: "v1", Resource: "configmaps"}).Namespace("team-a")
+			presence, err := ObserveResourcePresence(t.Context(), resource, "ConfigMap", "team-a", "app")
+			valid := scenario == "partial" || scenario == "partial-null"
+			if (err == nil) != valid || err == nil && (presence.State != "absent" || presence.CollectionResourceVersion != "opaque") {
+				t.Fatal("non-metadata/error/truncated response became absence", err)
+			}
+		})
+	}
+}

package/resource/runtime/presence_test.go

@@ -0,0 +1,85 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type presenceListFunc func(context.Context, metav1.ListOptions) (*metav1.PartialObjectMetadataList, error)
+
+func (f presenceListFunc) List(ctx context.Context, options metav1.ListOptions) (*metav1.PartialObjectMetadataList, error) {
+	return f(ctx, options)
+}
+
+func TestPresenceRequiresCompleteCurrentMetadataCollection(t *testing.T) {
+	for _, scenario := range []string{"absent", "present", "deleting", "http404", "rbac", "missing-version", "continued", "remaining", "foreign-name", "foreign-namespace", "missing-uid", "missing-object-version", "multiple", "nil-list"} {
+		t.Run(scenario, func(t *testing.T) {
+			items := &metav1.PartialObjectMetadataList{TypeMeta: metav1.TypeMeta{APIVersion: "meta.k8s.io/v1", Kind: "PartialObjectMetadataList"}, ListMeta: metav1.ListMeta{ResourceVersion: "opaque-collection-v"}}
+			item := metav1.PartialObjectMetadata{ObjectMeta: metav1.ObjectMeta{Name: "app", Namespace: "team-a", UID: types.UID("opaque-uid"), ResourceVersion: "opaque-object-v"}}
+			if scenario != "absent" {
+				items.Items = []metav1.PartialObjectMetadata{item}
+			}
+			switch scenario {
+			case "deleting":
+				now := metav1.Now()
+				items.Items[0].DeletionTimestamp = &now
+			case "missing-version":
+				items.ResourceVersion = ""
+			case "continued":
+				items.Continue = "next"
+			case "remaining":
+				n := int64(1)
+				items.RemainingItemCount = &n
+			case "foreign-name":
+				items.Items[0].Name = "other"
+			case "foreign-namespace":
+				items.Items[0].Namespace = "other"
+			case "missing-uid":
+				items.Items[0].UID = ""
+			case "missing-object-version":
+				items.Items[0].ResourceVersion = ""
+			case "multiple":
+				items.Items = append(items.Items, item)
+			case "nil-list":
+				items = nil
+			}
+			calls := 0
+			client := presenceListFunc(func(ctx context.Context, options metav1.ListOptions) (*metav1.PartialObjectMetadataList, error) {
+				calls++
+				deadline, ok := ctx.Deadline()
+				if options.FieldSelector != "metadata.name=app" || options.Limit != 2 || options.ResourceVersion != "" || options.Continue != "" || options.Watch || !ok || time.Until(deadline) > 5*time.Second {
+					t.Fatal("metadata observation expanded its target, consistency or budget")
+				}
+				if scenario == "http404" || scenario == "rbac" {
+					return nil, errors.New(scenario)
+				}
+				return items, nil
+			})
+			result, err := ObserveResourcePresence(t.Context(), client, "ConfigMap", "team-a", "app")
+			valid := scenario == "absent" || scenario == "present" || scenario == "deleting"
+			if calls != 1 || (err == nil) != valid {
+				t.Fatal("incomplete/error collection became absence or expanded queries", err)
+			}
+			if valid && (result.ValidateFor("ConfigMap", "team-a", "app") != nil || (result.State == "present") != (scenario != "absent") || (result.DeletionTimestamp != nil) != (scenario == "deleting")) {
+				t.Fatal("metadata identity was lost")
+			}
+		})
+	}
+}
+
+func TestPresenceRejectsUnsupportedTargetBeforeRead(t *testing.T) {
+	client := presenceListFunc(func(context.Context, metav1.ListOptions) (*metav1.PartialObjectMetadataList, error) {
+		t.Fatal("invalid target caused Kubernetes read")
+		return nil, nil
+	})
+	for _, target := range [][3]string{{"ConfigMap", "", "app"}, {"Node", "team-a", "app"}, {"Unknown", "", "app"}, {"CustomResourceDefinition", "", "app"}, {"ConfigMap", "team-a", ""}} {
+		if _, err := ObserveResourcePresence(t.Context(), client, target[0], target[1], target[2]); err == nil {
+			t.Fatal("unsupported target accepted")
+		}
+	}
+}

package/resource/runtime/relations.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	resource "github.com/opensoha/soha-contracts/resource"
+	resource "github.com/opensoha/soha/contracts/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/rest"
 )

package/resource/runtime/relations_test.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 )

package/resource/runtime/resource_edit.go

@@ -10,6 +10,7 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/client-go/dynamic"
@@ -17,6 +18,27 @@ import (
 	"k8s.io/utils/ptr"
 )
 
+// BindResourceEditIdentity keeps legacy name-based edits and validates observed edits
+// before attaching the live object's optimistic concurrency preconditions.
+func BindResourceEditIdentity(current, desired *unstructured.Unstructured, resource schema.GroupResource, requireObserved bool) error {
+	if requireObserved {
+		if desired.GetUID() == "" || desired.GetResourceVersion() == "" {
+			return apierrors.NewBadRequest("observed YAML must include metadata.uid and metadata.resourceVersion")
+		}
+		if desired.GetUID() != current.GetUID() || desired.GetResourceVersion() != current.GetResourceVersion() {
+			return apierrors.NewConflict(resource, current.GetName(), errors.New("resource changed since the YAML was read"))
+		}
+	}
+	desired.SetUID(current.GetUID())
+	desired.SetResourceVersion(current.GetResourceVersion())
+	return nil
+}
+
+// IsResourceEditOwnershipConflict separates a dry-run ownership report from stale identity.
+func IsResourceEditOwnershipConflict(err error) bool {
+	return apierrors.HasStatusCause(err, metav1.CauseTypeFieldManagerConflict)
+}
+
 // ApplyResourceEdit preserves SSA conflicts while migrating this editor's own Create/Update fields.
 // Dry-run migration validates a complete manifest with Update; it never changes live ownership.
 func ApplyResourceEdit(ctx context.Context, resource dynamic.ResourceInterface, current, desired *unstructured.Unstructured, manager string, dryRun bool) (*unstructured.Unstructured, error) {

package/resource/runtime/resource_edit_test.go

@@ -30,6 +30,38 @@ func editConflict(manager string) error {
 	return apierrors.NewApplyConflict([]metav1.StatusCause{{Type: metav1.CauseTypeFieldManagerConflict, Field: ".data.phase", Message: fmt.Sprintf("conflict with %q using v1", manager)}}, "field conflict")
 }
 
+func TestBindResourceEditIdentity(t *testing.T) {
+	resource := schema.GroupResource{Resource: "configmaps"}
+	current := editFixture()
+	for _, tc := range []struct {
+		name, uid, version string
+		strict             bool
+		wantError          func(error) bool
+	}{
+		{name: "legacy name only"},
+		{name: "observed current object", uid: "original", version: "1", strict: true},
+		{name: "missing observed identity", uid: "original", strict: true, wantError: apierrors.IsBadRequest},
+		{name: "same name replacement", uid: "deleted", version: "1", strict: true, wantError: apierrors.IsConflict},
+		{name: "same UID newer version", uid: "original", version: "0", strict: true, wantError: apierrors.IsConflict},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			desired := current.DeepCopy()
+			desired.SetUID(types.UID(tc.uid))
+			desired.SetResourceVersion(tc.version)
+			err := BindResourceEditIdentity(current, desired, resource, tc.strict)
+			if tc.wantError != nil {
+				if !tc.wantError(err) || string(desired.GetUID()) != tc.uid || desired.GetResourceVersion() != tc.version {
+					t.Fatalf("stale request unexpectedly rebound: uid=%q version=%q err=%v", desired.GetUID(), desired.GetResourceVersion(), err)
+				}
+				return
+			}
+			if err != nil || desired.GetUID() != current.GetUID() || desired.GetResourceVersion() != current.GetResourceVersion() {
+				t.Fatalf("current identity not preserved: uid=%q version=%q err=%v", desired.GetUID(), desired.GetResourceVersion(), err)
+			}
+		})
+	}
+}
+
 func TestApplyResourceEditMigratesOnlyItsOwnCreationFields(t *testing.T) {
 	for _, test := range []struct {
 		name                                                     string